Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Hacked a Router

disconnected.io

Post reply on HN
Print view View original

11–20 of 96 posts

Re: How I Hacked a Router

#11

Post by batuhanicoz »

meowface wrote: post #8
refurb wrote: post #7

I'm curious how the email attack worked, don't most web-based email services flag emails that come from one domain, but contain a link to another?

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though.

Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

Re: How I Hacked a Router

#12

Post by maxerickson »

aaronem wrote: post #10
ushi wrote: post #6

Earlier quoted context omitted.

Thats exactly what i mean - checksums are useless in this scenario. They should have been signed with a key your computer knows. (Retrieved before the first install)

Oh, I see what you mean. I wish I saw a way for that to happen in the Windows ecosystem, although I suppose the "Windows Store" might drive evolution in that direction.

It does exist:

http://blogs.msdn.com/b/ieinternals/archive/2011/03/22/authe...

The problem is that it doesn't help users any, the only way to stop them is to take control of the system away and it doesn't go that far.

Re: How I Hacked a Router

#13

Post by aaronem »

meowface wrote: post #8
refurb wrote: post #7

I'm curious how the email attack worked, don't most web-based email services flag emails that come from one domain, but contain a link to another?

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

That's an excellent question, especially since LinkedIn publishes an SPF record specifying both the IP ranges and the second-level domain name of legitimate MXes for its mail; prior to the DNS hijack, I'm not sure how it would be possible to carry out the phishing attack without giving any hint of foul play. (I do implicitly assume such hints would've stopped the target from clicking the bogus link, but given the way he's described in the article, I think that's not too unreasonable an assumption.)

Re: How I Hacked a Router

#14

Post by aaronem »

batuhanicoz wrote: post #11
meowface wrote: post #8

Earlier quoted context omitted.

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though. Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

But the attacker didn't yet control the DNS when he sent the link to the exploit; he needed the exploit in order to compromise the router and put the DNS hijack in place. So I'm not sure how the hell it worked.

Re: How I Hacked a Router

#15

Post by btown »

batuhanicoz wrote: post #11
meowface wrote: post #8

Earlier quoted context omitted.

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though. Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

Note that at that point in the attack, he had not yet gained access to the router, so he didn't control DNS yet.

Re: How I Hacked a Router

#16

Post by [deleted] »

batuhanicoz wrote: post #11
meowface wrote: post #8

Earlier quoted context omitted.

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though. Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

[deleted]

Re: How I Hacked a Router

#17

Post by yesiamyourdad »

refurb wrote: post #9
meowface wrote: post #8

Earlier quoted context omitted.

Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.

Exactly, I'm not much of a techie, but checking the domains of suspicious links is the first thing I do.

The problem with most phishing emails are that they suck - they don't even pass a cursory smell test. A linkedin from someone I know who I'm not already connected with (not too hard to figure out potential connections especially if you've worked for small companies), worded exactly like a linked in email only changing the accept button link? Odds are I'd click and not look at the link target.

Re: How I Hacked a Router

#20

Post by batuhanicoz »

btown wrote: post #15
batuhanicoz wrote: post #11

Earlier quoted context omitted.

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though. Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

Note that at that point in the attack, he had not yet gained access to the router, so he didn't control DNS yet.

Oh yes, I missed that fact. Sorry.
Post reply on HN